Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities
Summary
An evaluation report of the Program Evaluation Division of the Office of the Legislative Auditor of the State of Minnesota, titled Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities, with a transmittal dated March 2022. It examines how the Department of Employment and Economic Development (DEED) prevents and detects fraudulent applications by imposters and hijackers. The report states that DEED uses a variety of processes, some of which the evaluators found effective, but does not collect the data needed to evaluate them. Its summary states that the UI Division received nearly 24,000 fraud allegation reports in Fiscal Year 2021 and stopped payments on about 2,500 suspicious accounts in June 2021. The report includes recommendations and a response from Commissioner Steve Grove dated March 11, 2022.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Document type
- Report
Cite this document
“Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities.”
Original at www.auditor.leg.state.mn.us. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/unemployment-insurance-program-efforts-to-prevent-and-detect-the-use-of-stolen-identities/
, SHA-256 b9de2955817c336ae81ddf75409a76df4cc81a5209740368e7529e78b945e630.Full text
Program Evaluation Division Office of the Legislative Auditor State of Minnesota Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities 2022 EVALUATION REPORT Program Evaluation Division The Program Evaluation Division was created within the Office of the Legislative Auditor (OLA) in 1975. The division’s mission, as set forth in law, is to determine the degree to which state agencies and programs are accomplishing their goals and objectives and utilizing resources efficiently. Topics for evaluations are approved by the Legislative Audit Commission (LAC), which has equal representation from the House and Senate and the two major political parties. However, evaluations by the office are independently researched by the Legislative Auditor’s professional staff, and reports are issued without prior review by the commission or any other legislators. Findings, conclusions, and recommendations do not necessarily reflect the views of the LAC or any of its members. OLA also has a Financial Audit Division that annually audits the financial statements of the State of Minnesota and, on a rotating schedule, audits state agencies and various other entities. Financial audits of local units of government are the responsibility of the State Auditor, an elected office established in the Minnesota Constitution. OLA also conducts special reviews in response to allegations and other concerns brought to the attention of the Legislative Auditor. The Legislative Auditor conducts a preliminary assessment in response to each request for a special review and decides what additional action will be taken by OLA. For more information about OLA and to access its reports, go to: www.auditor.leg.state.mn.us. Evaluation Staff Judy Randall, Legislative Auditor Caitlin Badger Gretchen Becker Eleanor Berry Stephanie Besst Sarah Delacueva Scott Fusco Will Harrison David Kirchner Kelly Lehr Lucas Lockhart Ryan Moltz Jodi Munson Rodríguez Kaitlyn Schmaltz Laura Schwartz Katherine Theisen Caitlin Zanoni-Wells To obtain reports in electronic ASCII text, Braille, large print, or audio, call 651-296-4708. People with hearing or speech disabilities may call through Minnesota Relay by dialing 7-1-1 or 1-800-627-3529. To offer comments about our work or suggest an audit, investigation, or evaluation, call 651-296-4708 or e-mail legislative.auditor@state.mn.us. Printed on Recycled Paper Photo provided by the Minnesota Department of Administration with recolorization done by OLA. (https://www.flickr.com/photos/139366343@N07/25811929076/in/album-72157663671520964/) Creative Commons License: https://creativecommons.org/licenses/by/2.0/legalcode OFFICE OF THE LEGISLATIVE AUDITOR STATE OF MINNESOTA • Judy Randall, Legislative Auditor Room 140 Centennial Building, 658 Cedar Street, St. Paul, Minnesota 55155-1603 • Phone: 651-296-4708 • Fax: 651-296-4712 E-mail: legislative.auditor@state.mn.us • Website: www.auditor.leg.state.mn.us • Minnesota Relay: 1-800-627-3529 or 7-1-1 O L A March 2022 Members of the Legislative Audit Commission: The Department of Employment and Economic Development (DEED) administers Minnesota’s Unemployment Insurance (UI) program, which provides cash benefits to eligible individuals who have become unemployed. Due to its size, the UI program can be a target for various types of fraud. This evaluation focused on DEED’s efforts to prevent and detect a specific type of fraud: fraudulent applications from those who steal individuals’ identities to apply for benefits in their names, or who take over real applicants’ accounts to divert those applicants’ benefits. We found that DEED uses a variety of processes to prevent and detect the use of stolen identities in the UI program, some of which we found effective. However, we also found that DEED does not collect the necessary data to evaluate these processes sufficiently, and it has not established metrics or methods for doing so. Because a significant portion of the fraud prevention and detection processes that we reviewed as part of this evaluation are classified as not public under Minnesota Statutes 2021, Chapters 13 or 268, we have redacted significant portions of this report. Further, due to the extent of not public information contained in Chapter 3 of this report, we have not published it with the rest of the report; however, a redacted version of Chapter 3 is available upon request. This evaluation was conducted by Laura Schwartz (project manager), Stephanie Besst, and Scott Fusco. DEED cooperated with the evaluation, and we thank them for their assistance. Sincerely, Judy Randall Legislative Auditor O L A OFFICE OF THE LEGISLATIVE AUDITOR March 2022 Room 140 Centennial Bldg. 658 Cedar Street St. Paul, MN 55155-1603 legislative.auditor@state.mn.us www.auditor.leg.state.mn.us Tel: 651-296-4708 • Fax: 651-296-4712 Minnesota Relay: 1-800-627-3529 or 7-1-1 Summary Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities Not-Public Subject Matter Under state law, many of the fraud prevention and detection processes that we discuss in this report are classified as nonpublic security information or are otherwise classified as not public.1 As a result, we have redacted all not-public information from the public version of this report, and have provided the Department of Employment and Economic Development (DEED) with an unredacted version. This summary lists all of our public findings and recommendations. Background • Unemployment Insurance (UI) is a joint federal-state program; the UI Division within DEED administers the program in Minnesota. • Employers pay for UI program benefits. Under state law, eligible unemployed workers may receive weekly UI benefits of up to 50 percent of their prior average weekly wages, up to a maximum set in law. Only individuals who are unemployed through no fault of their own, who are able and available to work, and who worked in “covered employment” are eligible for benefits. • Individuals attempt to defraud the UI program in a variety of ways. In this report, we focused on the division’s efforts to prevent and detect fraud by “imposters” and “hijackers.” An imposter is an individual who uses the identity of someone who does not already have a UI account to create an account in their name. A hijacker is an individual who accesses and takes over a genuine accountholder’s existing account to steal their benefits. • The UI Division’s information technology system contains a complex set of automated rules that verify applicants’ identities and determine their eligibility for benefits. The division also uses information from employers to crosscheck the accuracy of information that applicants submit. Division staff manually review some information that applicants and employers provide to verify applicants’ identities and determine their eligibility for benefits. • In response to the COVID-19 pandemic, federal and state policymakers authorized temporary changes to the UI program. UI Division officials told us a drastic increase in UI applications during the pandemic, paired with temporary changes to program requirements, strained the division’s ability to perform its standard fraud prevention and detection processes. 1 Minnesota Statutes 2021, 13.37, subds. 1(a), 1(b), and 2(a); 13.39; and 268.19, subd. 1. S-2 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities Reporting and Investigations • The reports that the UI Division submits to the U.S. Department of Labor do not capture the full extent of possible fraud that the UI program experiences, particularly the threat that imposters and hijackers pose. And, state law does not explicitly require DEED to report information about fraud in the UI program to the Minnesota Legislature. o Recommendation ► The Legislature could consider requiring DEED to report, on a regular basis, about fraud in the UI program. • The UI Division focuses more on preventing the loss of program dollars by imposters and hijackers than on investigating those individuals. The division has referred few cases to law enforcement in recent years. o Recommendation ► The UI Division should evaluate its processes for referring fraud cases to the Bureau of Criminal Apprehension for investigation. o Recommendation ► The UI Division should submit a formal request to the U.S. Department of Labor’s Office of Inspector General for additional coordination and resources in investigating and combatting fraud from imposters and hijackers. Fraud Prevention and Detection • In Fiscal Year 2021, the UI Division received nearly 24,000 fraud allegation reports from the public, most alleging an imposter applied for benefits using a stolen identity. UI Division staff reviewed most of the fraud allegation reports and associated accounts in our sample quickly. • The UI Division regularly conducts data analyses to identify and lock accounts with suspicious characteristics that indicate they may have been opened by imposters or hijackers. These processes were effective in quickly identifying and locking the suspicious accounts in our sample. • During the COVID-19 pandemic, the UI Division began temporarily locking all accounts with certain characteristics to protect against phishing attacks, which likely affected payments to some genuine applicants. • The UI Division relies on applicants to identify when it has incorrectly locked their accounts, which may cause burdens for those applicants. • While temporary changes to the UI program may have addressed policy needs during the pandemic, they also complicated the UI Division’s ability to prevent and detect fraud. Amid challenges presented by the pandemic, the division instituted new screening processes to prevent payments to imposter accounts. • The UI Division’s new imposter screening processes provided time for the division to stop initial payments on suspicious accounts; in June 2021, the division stopped payments on about 2,500 suspicious accounts—more than one-third of all new accounts opened that month. While DEED uses a variety of processes to help prevent and detect the use of stolen identities in the UI program, it has not measured the efficacy of those processes or the extent to which they may affect timely payments to applicants. Summary S-3 • The UI Division’s new imposter screening processes delayed payments to most applicants by more than a week, even though an executive order, and subsequent legislation, temporarily suspended the typical one-week waiting period. While the UI Division’s new imposter screening processes helped prevent payments on suspicious accounts, they also likely created burdens for some genuine applicants who were entitled to benefits. o Recommendation ► The UI Division should develop processes to proactively investigate accounts that may be incorrectly identified as suspicious. • The UI Division has not established metrics or methods for evaluating the efficacy of its data analysis processes or its new imposter screening processes, nor has it collected the data to perform such evaluations. o Recommendations ► The UI Division should: (1) establish metrics and methods for evaluating the efficacy of its data analysis processes and imposter screening processes; (2) evaluate these processes on a regular basis; (3) collect the necessary data to conduct such evaluations; and (4) use such evaluations to refine its processes. o Recommendation ► As the initial challenges created by the COVID-19 pandemic subside, the UI Division should reevaluate some of the changes it implemented during the pandemic to prevent and detect fraud, as those changes competed with its responsibility to issue prompt payments to eligible applicants. Summary of Agency Response In a letter dated March 11, 2022, Department of Employment and Economic Development (DEED) Commissioner Steve Grove said that the COVID-19 pandemic, and the expansion of UI benefits during the pandemic, created an opportunity for cybercriminals. But, he said, DEED responded quickly to the various challenges presented by the pandemic. The Commissioner suggested that it may be duplicative for DEED to report to the Minnesota Legislature in addition to the federal government, as OLA recommends that the Legislature consider. He also disagreed with OLA’s finding that some of the new fraud prevention and detection processes that DEED instituted during the pandemic delayed payments to most applicants. In addition, he said DEED in fact took certain actions discussed in the report to prevent a delay in benefits created by cybercriminals. And, he said OLA misstated a purpose of Executive Order 20-05, which allowed workers “to become eligible for unemployment benefits as quickly as possible.” The Commissioner said that DEED is committed to continually monitoring and updating its approach to detecting and stopping cybercriminals, as recommended by OLA. He said DEED has a responsibility to work to maintain a balance between stopping cybercriminals and ensuring that genuine applicants can access the benefits for which they are eligible. The Commissioner said that DEED took, and continues to take, effective measures to ensure that the state’s “UI application has a robust and resilient response to active and emergent cyberthreats.” The full evaluation report, Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities, is available at 651-296-4708 or: www.auditor.leg.state.mn.us/ped/2022/uifraud.htm Table of Contents 1 Introduction 3 Chapter 1: Background 3 Program Overview 6 Fraud 8 Identity Verification and Eligibility Determination Processes 10 COVID-19 Pandemic 15 Chapter 2: Fraud Reporting and Investigations 15 Fraud Reporting 18 Fraud Investigations Agency Response Introduction ny program that distributes public dollars can be subject to fraud. Program integrity is especially important in large programs, like Minnesota’s Unemployment Insurance (UI) program, which distributed more than $775 million in benefits in Fiscal Year 2019. The program—which is overseen by the U.S. Department of Labor (USDOL) and administered by the Minnesota Department of Employment and Economic Development (DEED)—provides workers who are unemployed through no fault of their own with temporary partial wage replacement. In June 2021, the Legislative Audit Commission directed the Office of the Legislative Auditor (OLA) to evaluate UI fraud. Fraud is a multifaceted problem, which can take numerous forms in the UI program. In scoping this evaluation, we focused on issues that fall under greater state control, rather than federal control, and that OLA has not recently audited, among other factors. For example, in 2021, OLA’s Financial Audit Division audited the extent to which DEED correctly determined applicants’ eligibility, paid the correct benefits amounts, and recouped overpayments, among other things.1 Therefore, we did not revisit the subjects of that audit in this program evaluation. For the most part, we did not evaluate DEED’s efforts to prevent or detect fraud committed by employers or individuals who misrepresent their eligibility for benefits. Rather, in this program evaluation, we focused narrowly on DEED’s efforts to prevent and detect fraudulent applications from those who steal individuals’ identities to apply for benefits in their names, or who take over real applicants’ accounts to divert those applicants’ benefits. During the early months of the COVID-19 pandemic, both media outlets and USDOL reported increased fraud attempts by such individuals. In this evaluation, our key evaluation questions included: • What processes does DEED use to prevent and detect fraudulent applications? • How effective are DEED’s processes for preventing and detecting fraudulent applications? To conduct this evaluation, we used a variety of methods. We reviewed state and federal legal requirements, as well as fraud prevention and detection practices recommended by the federal government. We also examined DEED’s fraud prevention and detection processes and interviewed DEED officials to learn about those processes. In addition, we analyzed a sample of the fraud allegation reports that DEED receives from the public, as well as other program data, to determine how well DEED prevents and detects fraud. Under state law, many of DEED’s fraud prevention and detection processes are classified as nonpublic security information, or are classified as not public for other reasons.2 We have redacted all not-public information from chapters 1 and 2 of this report. We have also provided another chapter (Chapter 3), which contains largely not-public information, to DEED. A redacted version of Chapter 3 is available upon request. 1 The Financial Audit Division conducted this audit as part of the state’s federally mandated audit of state programs that receive federal funding. See State of Minnesota, Minnesota Management and Budget, 2020 Financial and Compliance Report on Federally Assisted Programs for the Year Ended June 30, 2020 (St. Paul, 2021). 2 Minnesota Statutes 2021, 13.37, subds. 1(a), 1(b), and 2(a); and 268.19, subd. 1. A Chapter 1: Background innesota’s Unemployment Insurance (UI) program provides eligible unemployed workers with income while they search for new employment.1 Because the program distributes payments to a large number of workers each week, it can be a target for fraud. In this chapter, we provide an overview of the UI program and the types of fraud that the program experiences. We also discuss the program’s processes for verifying the identity and determining the eligibility of applicants, as well as some challenges the program faced during the COVID-19 pandemic. Program Overview Unemployment Insurance is a joint federal-state program; the UI Division within the Department of Employment and Economic Development (DEED) administers the program in Minnesota. The U.S. Department of Labor (USDOL) is responsible for setting UI program policies, ensuring that state programs comply with federal law, developing performance metrics, and monitoring states’ performance. Federal law establishes basic parameters that states must follow in administering their UI programs, but states also have flexibility in how they administer their programs.2 The UI Division within DEED is responsible for processing UI applications, determining applicants’ eligibility, and issuing timely payments, among other things. According to the division, at the end of Fiscal Year 2021, it had about 400 full-time-equivalent staff who carried out these duties. Benefits Under state law, eligible unemployed workers may receive weekly UI benefits of up to 50 percent of their prior average weekly wages, up to a maximum set in law. State law establishes the amount and duration of UI benefits for Minnesota workers. Generally, eligible individuals who apply for benefits may receive weekly cash payments of up to 50 percent of their prior average weekly wages, up to a dollar cap set in law.3 Typically, individuals may receive benefits for up to 26 weeks, or until their cumulative benefits amount to 33.3 percent of their total prior annual wages, whichever is lower.4 However, in periods of high state unemployment, they may be able to receive benefits for an extended period of time.5 1 Minnesota Statutes 2021, 268.03, subd. 1. 2 Social Security Act, 42 U.S. Code, Chapter 7 (2019); and Federal Unemployment Tax Act, 26 U.S. Code, Chapter 23 (2019). 3 See Minnesota Statutes 2021, 268.07, subd. 2a, for more details on how individuals’ weekly benefit amounts are calculated. 4 Minnesota Statutes 2021, 268.07, subd. 2a(c); and 268.035, subds. 4 and 27. 5 Minnesota Statutes 2021, 268.115. M 4 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities To receive benefits, eligible individuals must submit an initial application and weekly requests for benefits. The UI Division uses the information that applicants submit to determine both their initial and ongoing eligibility for benefits, as well as the amount of their cash benefits each week. Applicants request benefit payments on a weekly basis through their UI accounts, which they establish and access via a Web portal on the UI Division’s website. An eligible applicant should receive their first benefit payment the third week after they initially apply, according to the UI Division. This lag time occurs for two main reasons. First, applicants request benefits for a given week after that week has passed. Second, under Minnesota law, applicants may not receive benefits during the first week that they would otherwise be eligible for them—this week is referred to as an applicant’s “nonpayable week.”6 So, typically an applicant can receive their first payment the third week after they initially apply, for their second week of eligibility. Exhibit 1.1 illustrates this timing. Under certain circumstances, applicants may also back-date their initial applications by one week to receive a retroactive payment for a week of unemployment that occurred before they submitted their initial application.7 Eligibility Only individuals who are unemployed through no fault of their own, who are able and available to work, and who worked in “covered employment” are eligible for UI benefits. Both state and federal law establish eligibility requirements for UI benefits. We outline some of those key requirements in Exhibit 1.2. One such requirement is that only individuals who worked in “covered employment” may be eligible for benefits.8 Covered employment includes work performed by an individual who is considered “an 6 Minnesota Statutes 2021, 268.085, subd. 1(6). 7 Minnesota Statutes 2021, 268.07, subd. 3b(a). An initial application for UI benefits is effective the Sunday of the calendar week that the individual submitted the application. 8 Minnesota Statutes 2021, 268.035, subds. 4, 11-12, 15(1), 20, and 27; and 268.07, subd. 2(a); and Minnesota Rules, 3315.0555, https://www.revisor.mn.gov/rules/3315, accessed June 15, 2021. Definition Nonpayable week: Under state law, an applicant may not receive benefits during the first week they are otherwise eligible for them. — Minnesota Statutes 2021, 268.085, subd. 1(6) Application Timing Consider an individual who becomes unemployed on Monday, January 9, and applies for benefits on Tuesday, January 10. January Sun Mon Tue Wed Thu Fri Sat 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 The individual’s first benefit week would start on Sunday, January 8 (because benefit weeks always start on a Sunday). But, that week would be the applicant’s “nonpayable week.” On January 22, the applicant could submit a request for—and receive—benefits for the week of January 15. Exhibit 1.1 Background 5 employee under the common law [definition] of employer-employee and not an independent contractor.”9 Funding Employers pay for the UI program. The UI program is funded through federal and state taxes on and reimbursements by employers.10 A federal tax pays for several aspects of the UI program, including grants to cover state programs’ administrative costs, a share of extended UI benefits, and loans to states when they temporarily lack the funds to pay for benefits, among other things. To receive federal funding for program administration, states must meet a variety of federal requirements, such as administering their programs in ways that ensure benefits are paid in a timely manner.11 Minnesota’s UI program expended $52.5 million in federal grant funding for state Fiscal Year 2020.12 Minnesota’s UI Division also collects funds from employers, which pay for program benefits. The division collects these funds via two methods: (1) reimbursements on actual benefits paid and (2) quarterly payroll taxes.13 Certain employers, including the State of Minnesota, its political subdivisions, and American Indian tribes, must use the 9 See Minnesota Rules, 3315.0555, for state rules for determining whether a worker should be classified as an employee or an independent contractor. In addition to independent contract work, a variety of other types of work are not considered covered employment under Minnesota law, including certain types of agricultural, religious, student, and sales work, among others. Further, certain types of workers, including railroad workers, recent former Armed Forces servicemembers, and civilian federal employees are eligible for benefits through separate federal UI programs (which are also administered by the UI Division). 10 Only employers that provide “covered employment” pay for the program. 11 42 U.S. Code, sec. 503(a) (2019); and 20 CFR, sec. 640 (2021). 12 State of Minnesota, Revised 2022-2023 Biennial Budget (St. Paul, March 2021), 79. 13 Minnesota Statutes 2021, 268.051, subd. 1(a); 268.052, subds. 1-2; 268.0525; 268.053, subd. 1(a); and 268.194. To be eligible for UI benefits in Minnesota, individuals must, among other things: Be unemployed, or have substantially reduced hours, through no fault of their own. Be available for, actively seeking, and willing to accept suitable employment when offered. Have sufficient earnings from “covered employment” over the past four quarters. Be authorized to work legally in the U.S. Participate in reemployment assistance services, if directed to do so. Not be working or volunteering 32 hours or more per week. Not be incarcerated or performing court-ordered community service. Not be attending or on vacation from a secondary school. Not already be receiving UI benefits under federal law or another state’s laws. Not be receiving certain other benefits or payments, such as Workers’ Compensation, Social Security, severance, backpay, or retirement income. Exhibit 1.2 6 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities reimbursement method unless they elect to pay quarterly taxes instead.14 Nonprofit organizations may elect to use the reimbursement method as well, instead of paying quarterly taxes.15 All other employers must pay quarterly taxes. The UI Division determines a given employer’s quarterly tax rate based on a number of factors, including the amount of UI benefits paid in the recent past to that employer’s former workers.16 Minnesota General Fund dollars do not pay for any aspect of the UI program.17 Fraud The UI program distributes a large number of weekly cash payments each year. In Fiscal Year 2019, it paid out $775 million in benefits.18 Given the size of the program, and the speed at which the program issues such payments, it is not surprising that it can be a target for fraud. In this section, we briefly discuss some of the kinds of fraud that the program faces, as well as the UI Division’s responsibilities to prevent and detect that fraud. Types of UI Fraud Individuals attempt to defraud the UI program in a variety of ways. Under the law, making false statements or representations to obtain or to prevent someone else from obtaining UI benefits constitutes fraud.19 Individuals who commit UI fraud are subject to both administrative and criminal penalties. Individuals—including applicants and employers, as well as those who collude with them—attempt to defraud the UI program in a variety of ways. For example, employers might misclassify their workers as independent contractors to avoid paying UI taxes on their wages. Employers might also provide false information to the UI Division to prevent individuals from obtaining benefits for which they are eligible, or to help individuals who do not qualify for benefits obtain them. Likewise, individuals may 14 Minnesota Statutes 2021, 268.052, subds. 1-2; and 268.0525. 15 Minnesota Statutes 2021, 268.053, subd. 1(a). 16 Minnesota Statutes 2021, 268.047; and 268.051, subds. 2-3 and 6. 17 The Legislature appropriated $25 million from the General Fund for Fiscal Year 2021 to cover program costs in case federal funds did not arrive in time. Laws of Minnesota 2020, Seventh Special Session, chapter 2, art. 3, sec. 2. 18 These figures include benefits paid from the regular UI program as well as the Unemployment Compensation for Federal Employees program, the Unemployment Compensation for Ex-Servicemembers program, and the Extended Benefits program. U.S. Department of Labor, Employment and Training Administration, ETA 5159: Claims and Payment Activities (Washington, DC, 2021), https://oui.doleta.gov /unemploy/DataDownloads.asp, accessed January 20, 2022. 19 Minnesota Statutes 2021, 268.18, 268.182, 268.183, and 268.184. 137,000 employers paid into the UI program in Fiscal Year 2019. Background 7 misrepresent their eligibility for benefits—such as by lying about the manner in which they separated from their employer. One of the largest sources of fraud in the program comes from individuals misrepresenting their eligibility by not reporting all of their income while receiving benefits.20 In this evaluation, we focused specifically on fraud committed by “imposters” and “hijackers.” Imposters use the stolen identities of individuals who do not already have UI accounts to apply for benefits in their names. Hijackers access and take over legitimate UI accounts to divert the accountholders’ benefits. UI Division officials told us that, during the COVID-19 pandemic, imposters and hijackers became a much larger threat to the program than they had been previously, which we discuss later. Legal Requirements for Preventing and Detecting Fraud While the UI Division is responsible for preventing and detecting UI fraud, it has some flexibility in how it carries out this responsibility. For example, state law requires the division to prevent waste or unnecessary spending of public money, but it does not specify the kinds of fraud prevention or detection activities that the UI Division must conduct within the UI program.21 Similarly, while federal law specifies some activities that states must perform to prevent or detect UI fraud, states also have discretion in this area.22 For example, as we discuss later in the report, federal law requires state UI programs to regularly audit samples of UI accounts to measure the accuracy of benefit payments, using federally established methodologies.23 Additionally, USDOL interprets federal law as requiring states to perform various activities to prevent and detect fraud as a condition to receive federal administrative grants, but states have flexibility over some of these activities.24 USDOL also recommends various fraud prevention and detection activities for states to conduct, such as analyzing program data for accounts with suspicious characteristics. 20 OLA’s Financial Audit Division has previously audited the UI program’s compliance with federal eligibility criteria. State of Minnesota, Minnesota Management and Budget, 2020 Financial and Compliance Report on Federally Assisted Programs for the Year Ended June 30, 2020 (St. Paul, 2021), 150-155. 21 Minnesota Statutes 2021, 116J.011, (1). 22 42 U.S. Code, secs. 503(a)(1) and (6) (2019); and 20 CFR, sec. 614, Appendix C, parts 7510-7515 (2012). 23 20 CFR, secs. 602.20 and 602.21 (2021). 24 20 CFR, sec. 614, Appendix C, part 7511 (2012); U.S. Department of Labor, Employment and Training Administration, Unemployment Insurance Program Letter, 23-20 (Washington, DC, 2020); and U.S. Department of Labor, Employment and Training Administration, Unemployment Insurance Program Letter, 28-20 (Washington, DC, 2020). Definitions Fraud: Making false statements or representations to obtain or prevent someone else from obtaining UI benefits. Imposter: An individual who uses the identity of someone who does not already have a UI account to create an account in their name. Hijacker: An individual who accesses and takes over a genuine accountholder’s existing account to steal their benefits. 8 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities Identity Verification and Eligibility Determination Processes In this section, we briefly discuss how the division uses its information technology system, employers, and manual staff processes to verify applicants’ identities and determine their eligibility for benefits. Information Technology System The UI Division’s information technology system contains a complex set of automated rules that verify applicants’ identities and determine their eligibility for benefits. The UI Division’s information technology system (“UI System”) contains a Web portal that both applicants and employers use to open and manage their UI accounts. Most applicants use the Web portal to submit their initial applications as well as their weekly requests for benefits; employers use it to review or dispute applications submitted by former employees, among other things. The UI System uses the information input by applicants and employers to attempt to verify an applicant’s identity and determine their eligibility for benefits. As required by federal law, the UI System crosschecks certain application information, including applicants’ Social Security numbers and legal authority to work in the U.S., against information in external databases.25 When the UI System needs additional information from an applicant to determine their eligibility for benefits, it automatically creates an “eligibility issue” within the system. In many, but not all, circumstances, the UI System will not release a payment to an applicant until an eligibility issue is resolved. When the UI System generates an eligibility issue, it prompts the applicant to fill out a questionnaire with additional information. In some cases, the UI System also prompts the applicant’s former employers to provide information about their former employee—such as about the manner in which the employee left the employer—so the division can determine the applicant’s eligibility. 25 42 U.S. Code, sec. 503(f) (2019). We did not review UI System compliance with federal requirements as part of this evaluation. Definition Eligibility Issue: A flag in the UI System that indicates that the division needs additional information to determine an applicant’s eligibility for benefits. Background 9 Employer Processes The UI Division uses information from employers to crosscheck the accuracy of information that applicants submit. Employers are also an important part of the UI program’s process for verifying applicants’ identities and determining their eligibility for benefits. State law requires employers to submit “quarterly wage detail reports” to the UI Division with the names and Social Security numbers of each employee, the employees’ wages, and the number of hours that employees worked that quarter.26 The division uses the information in these reports to check the accuracy of applicant-reported information, such as whether an applicant really worked for an employer for whom they said they worked, or whether they earned the wages they said they earned. The division also encourages employers to raise eligibility issues on applications. State law requires the division to notify applicants’ recent employers when they apply for benefits.27 This notification gives employers an opportunity to raise within the UI System eligibility issues about which the division might not know. For example, an employer could raise an eligibility issue if an employee who was discharged for cause tried to obtain benefits. The division also relies on employers to help resolve eligibility issues. For example, under certain conditions (such as being a victim of sexual harassment) an individual who quits their job could still be eligible for benefits.28 If an individual indicates on their application that they quit their job, then the division might request that both they and their former employer complete a questionnaire with details about the circumstances behind their departure. The division then compares their responses with their former employer’s responses—and other available evidence—to determine whether they are eligible for benefits. If a former employer does not respond to a request for information, then the UI Division may make an eligibility determination without their input, using the evidence available. Because employers’ UI tax rates are contingent upon the amount of UI benefits paid to their former employees (as we discussed earlier), they have an incentive to respond to such requests for information. Staff Processes UI Division staff manually review some information that applicants and employers provide to verify applicants’ identities and determine their eligibility for benefits. Although some of the UI program’s eligibility determination and identity verification processes are automated, others require direct involvement by UI Division staff. The UI Division maintains a Customer Service Center whose staff answer questions from both individuals and employers, help individuals complete their applications over the phone, and transfer calls from individuals who speak languages other than English to 26 Minnesota Statutes 2021, 268.044, subd. 1(a). 27 Minnesota Statutes 2021, 268.101, subd. 1(b). 28 Minnesota Statutes 2021, 268.095. 10 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities interpreters. Senior staff in the Customer Service Center called “adjudicators” handle more complex calls. For example, they manually review information or documentation that applicants and employers submit that is necessary to resolve eligibility issues. They also determine when an applicant’s actions constitute “misrepresentation” (that is, fraud), such as if an applicant failed to report earnings. If an adjudicator determines that misrepresentation occurred, the UI System automatically applies a penalty.29 Staff in the Customer Service Center typically do not resolve cases involving suspected imposters or hijackers. When staff suspect a caller may be an imposter or hijacker, or when they receive calls from a genuine applicant whose identity or account has been stolen, they perform various tasks to verify the identities of referred accountholders. For example, they may require applicants to mail in additional documentation . Staff then may compare those documents against information in external databases. They may also ask accountholders to take additional actions that those attempting to commit fraud are unlikely to do . If an applicant or an employer does not agree with an eligibility determination, then they may appeal the decision to a UI law judge within 20 days of a determination.30 UI law judges are attorneys employed by the UI Division to hear and rule on these appeals; they must follow procedures outlined in rules.31 Applicants and employers may appeal a UI law judge’s ruling to the Minnesota Court of Appeals.32 COVID-19 Pandemic The COVID-19 pandemic impacted the UI program significantly. In this section, we discuss the state’s unemployment levels during the pandemic, temporary changes to the UI program in response to the pandemic, and challenges that the pandemic created for the program. Unemployment Levels Unemployment in Minnesota rose sharply at the beginning of the COVID-19 pandemic. In February 2020, the state’s seasonally adjusted unemployment rate was 3.3 percent, with about 103,600 unemployed persons.33 Just three months later, in May 2020, that rate reached 11.3 percent, with about 348,300 unemployed persons. The peak 29 Under state law, if an individual receives a UI payment because they misrepresented themselves, they must receive a penalty of 40 percent of the amount overpaid. An individual who has misrepresented themselves to obtain benefits is also guilty of theft and subject to criminal sentencing. Minnesota Statutes 2021, 268.18, subd. 2; 268.182; and 268.183. 30 Minnesota Statutes 2021, 268.101, subd. 2(f). 31 Minnesota Statutes 2021, 268.105; and Minnesota Rules, Chapter 3310, https://www.revisor.mn.gov/rules /3310, accessed June 15, 2021. 32 Minnesota Statutes 2021, 268.105, subd. 7. 33 Minnesota Department of Employment and Economic Development, Local Area Unemployment Statistics (St. Paul, 2021), https://apps.deed.state.mn.us/lmi/ui/Results.aspx, accessed October 6, 2021. Background 11 pandemic unemployment rate surpassed the peak rate during the Great Recession by more than three percentage points, as Exhibit 1.3 shows. Temporary Program Changes In response to the COVID-19 pandemic, federal and state policymakers authorized temporary changes to the UI program. For example, the U.S. Congress approved supplemental UI programs that temporarily offered benefits for extended periods of time (as many as 53 additional weeks through one program) and provided supplemental payments on top of applicants’ regular weekly benefits (as much as $600 extra per week through one program).34 One of the programs also offered benefits to self-employed, contract, and “gig” workers, who are not typically eligible for UI benefits.35 Additionally, in Minnesota, Governor Walz temporarily suspended certain UI program requirements to make it easier for applicants to receive benefits. In mid-March 2020, the Governor issued an executive order stating that “strict compliance” with the statute governing Minnesota’s UI program be suspended.36 Among other things, the order temporarily suspended the requirement that applicants wait one week before receiving 34 Coronavirus Aid, Relief, and Economic Security Act, Public Law 116-136, 134 Stats. 318 and 323, secs. 2104 and 2107, March 27, 2020; and American Rescue Plan Act of 2021, Public Law 117-2, 135 Stat. 119, sec. 9016, March 11, 2021. 35 Coronavirus Aid, Relief, and Economic Security Act, Public Law 116-136, 134 Stat. 313, sec. 2102, March 27, 2020. A “gig” worker is someone who works temporary jobs as an independent contractor. 36 State of Minnesota Emergency Executive Order 20-05, “Providing Immediate Relief to Employers and Unemployed Workers During the COVID-19 Peacetime Emergency,” March 16, 2020. The order was in effect throughout the COVID-19 peacetime emergency (March 16, 2020, through July 1, 2021). Laws of Minnesota 2021, First Special Session, chapter 12, art. 2, sec. 23. Minnesota’s unemployment rate reached 11.3 percent during the COVID-19 pandemic, several points higher than during the Great Recession. Exhibit 1.3 8.0% 11.3% 0% 2% 4% 6% 8% 10% 12% 2006 2008 2010 2012 2014 2016 2018 2020 Calendar Year Great Recession Covid-19 Pandemic Unemployment Rate (Seasonally Adjusted) 12 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities benefits.37 In late March, the Legislature affirmed that aspect of the Governor’s order, passing the temporary suspension of the waiting (i.e., “nonpayable”) week into law.38 Program Challenges UI Division officials told us a drastic increase in UI applications during the pandemic, paired with changes to program requirements, strained the UI Division’s ability to perform its standard fraud prevention and detection processes. Amid high unemployment and temporary changes to program requirements, Minnesota’s UI applications increased dramatically during the pandemic, according to federal reports. As Exhibit 1.4 shows, the UI Division received around 1.7 million and 766,000 initial applications in calendar years 2020 and 2021, respectively—the first two years of the pandemic.39 In contrast, in the five calendar years preceding the pandemic (2015-2019), the division received an average of only about 250,200 initial applications per year. Likewise, according to federal reports, the division paid out approximately $4.8 billion and $2.6 billion in benefits in calendar years 2020 and 2021, respectively; but in the five preceding years, it paid out an average of only approximately $801 million.40 A division official, however, told us the figures in these federal reports 37 The suspension applied to accounts established between March 1, 2020, and December 31, 2020. The federal government pledged to reimburse states that suspended their nonpayable weeks for the cost of the benefits paid during those weeks. 38 Laws of Minnesota 2020, chapter 71, art. 2, sec. 21. 39 These figures include initial applications to the regular UI program as well as the Unemployment Compensation for Federal Employees program, the Unemployment Compensation for Ex-Servicemembers program, the Extended Benefits program, and two pandemic UI programs (the Pandemic Emergency Unemployment Compensation program and the Pandemic Unemployment Assistance program). U.S. Department of Labor, Employment and Training Administration, ETA 5159: Claims and Payment Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy/DataDownloads.asp, accessed January 20, 2022; and U.S. Department of Labor, Employment and Training Administration, ETA 902P: Pandemic Unemployment Assistance Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy /DataDownloads.asp, accessed January 20, 2022. 40 U.S. Department of Labor, Employment and Training Administration, ETA 5159: Claims and Payment Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy/DataDownloads.asp, accessed January 20, 2022; and U.S. Department of Labor, Employment and Training Administration, ETA 902P: Pandemic Unemployment Assistance Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy /DataDownloads.asp, accessed January 20, 2022. Initial UI applications rose sharply in 2020 and 2021, during the COVID-19 pandemic. Exhibit 1.4 Initial Applications (in millions) 0.5 1.0 1.5 2.0 2015 2016 2017 2018 2019 2020 2021 Calendar Year Background 13 are incomplete. The offical estimated the division actually paid out closer to $9.7 billion and $5.7 billion in calendar years 2020 and 2021, respectively.41 Although temporary changes to the UI program may have supported policy needs during the pandemic, they complicated the UI Division’s ability to combat fraud. For example, suspension of the nonpayable week reduced the amount of time the division had to screen new accounts for fraud before releasing payments to those accounts. Similarly, because certain workers who were not normally eligible for benefits (such as self-employed persons) could receive benefits under one of the temporary UI programs, the division could not use some of its standard methods to detect fraud, such as comparing the income that applicants attested they earned against records provided by employers. Additionally, UI Division officials told us that the increased size of the benefits offered during the pandemic made the program a more attractive target for imposters and hijackers—because those fraudsters could receive a larger payout over a shorter period of time. 41 These figures include all UI programs that the UI Division administered in calendar years 2020 and 2021. Chapter 2: Fraud Reporting and Investigations s policymakers strive to protect the integrity of large public programs, it is natural for them to wonder how much fraud exists in those programs and whether those who attempt to defraud those programs are being held accountable. During the COVID-19 pandemic, the UI program experienced a significant increase in application volume, and with it, an increase in fraud risk. In particular, fraud attempts by imposters and hijackers became a much larger threat than they had been previously.1 In this chapter, we discuss the extent to which the Department of Employment and Economic Development’s (DEED’s) Unemployment Insurance (UI) Division reports and investigates fraud, particularly by imposters or hijackers. Fraud Reporting We begin the chapter by discussing the extent to which the UI Division reports UI fraud to policymakers—the U.S. Department of Labor (USDOL) at the federal level, and the Minnesota Legislature at the state level. Federal Fraud Reporting The reports that the UI Division submits to the U.S. Department of Labor do not capture the full extent of possible fraud that the program experiences, particularly the threat that imposters and hijackers pose to the program. USDOL requires state UI programs to report on a quarterly basis the amount of fraud that they experience, including the number of cases of fraud and the dollar amounts of benefits paid in those cases, among other things.2 But, given narrow reporting definitions, challenges associated with reporting imposter and hijacker fraud, and an increased workload caused by the pandemic, the reports that the UI Division submits to USDOL do not paint a full picture of the fraud that the program may face. 1 As we discussed in Chapter 1, an imposter is an individual who uses the identity of someone who does not already have a UI account to create an account in their name. A hijacker is an individual who accesses and takes over a genuine accountholder’s existing account to steal their benefits. 2 42 U.S. Code, sec. 503(a)(6) (2019); 20 CFR, sec. 602.11 (2021); U.S. Department of Labor, Employment and Training Administration, Unemployment Insurance Handbook No. 401, 5th edition (Washington, DC, July 2017), 155-173; and U.S. Department of Labor, Employment and Training Administration, ETA 227: Overpayment Detection and Recovery Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy/DataDownloads.asp, accessed October 18, 2021. A 16 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities First, the UI Division reports to USDOL only on cases in which it has determined that an overpayment was made. An overpayment is a benefit payment made by the division to an applicant for which the applicant was not legally entitled.3 The division does not report cases in which it cannot identify the imposter or hijacker who received the overpayment. Nor does it report suspected fraud attempts by imposters or hijackers that the division stopped before issuing an overpayment. Second, imposter and hijacker fraud can be harder to confirm—and thus report on— than other types of fraud in the UI program. The division may be able to confirm fairly easily that an individual has been earning wages while improperly collecting UI benefits if the division receives relevant evidence to that effect—such as wage detail reports—from that individual’s employer.4 But, confirming imposter and hijacker fraud can be more difficult. One way the division detects imposter fraud is by screening accounts in the UI System for suspicious characteristics, which we discuss in Chapter 3.5 When the division finds a suspicious account, it stops or prevents payments to the account and then requires the accountholder to provide evidence to verify their identity. If the accountholder provides such evidence, then the division can be relatively assured that the account is not fraudulent. But, if the accountholder does not respond to the request, then the division still may not be sure whether the account is fraudulent. The accountholder could be an imposter who abandoned the account after receiving the division’s request, or they could be a genuine applicant who did not respond to the division’s request for any number of reasons—such as getting a job. Third, UI Division officials acknowledged that the program’s reporting efforts suffered during the pandemic amid the increased workload; they said the division likely has not yet investigated or reported all of the fraud that the program experienced during the pandemic. As Exhibit 2.1 shows, the division reported only 1,170 cases of confirmed fraud to USDOL in calendar year 2020, which was 77 percent fewer than it reported in calendar year 2019, the year before the pandemic began.6 Despite these figures, 3 A fraud overpayment is an “overpayment for which material facts…are found to be knowingly misrepresented or concealed (i.e., willful misrepresentation) by the [applicant] in order to obtain benefits to which the [applicant] is not legally entitled.” U.S. Department of Labor, Employment and Training Administration, Unemployment Insurance Handbook No. 401, 5th edition (Washington, DC, July 2017), 163. 4 As we discussed in Chapter 1, state law requires employers to submit quarterly wage detail reports to the UI Division with the names and Social Security numbers of each employee, the employees’ wages, and the number of hours that employees worked that quarter. Minnesota Statutes 2021, 268.044, subd. 1(a). 5 As we discussed in Chapter 1, applicants create accounts in the UI Division’s information technology system (UI System) through a portal on the division’s website when they apply for benefits. Applicants submit their weekly requests for benefits through these online accounts. 6 These figures include only fraud cases from the regular UI program, not from the Unemployment Compensation for Federal Employees program, the Unemployment Compensation for Ex-Servicemembers program, the Extended Benefits program, or three pandemic UI programs (the Federal Pandemic Unemployment Compensation program, the Pandemic Emergency Unemployment Compensation program, and the Pandemic Unemployment Assistance program). U.S. Department of Labor, Employment and Training Administration, ETA 227: Overpayment Detection and Recovery Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy/DataDownloads.asp, accessed October 18, 2021. The UI Division often lacks conclusive evidence that an account was opened by an imposter or a hijacker, which makes those cases difficult to confirm as fraud—and thus— to quantify. Fraud Reporting and Investigations 17 division officials told us that fraudulent activity dramatically increased—rather than decreased—during the pandemic. Minnesota was not alone among states in reporting a decrease in fraud in recent years. Combined, states reported about 40 percent fewer cases of fraud in calendar year 2020 than in calendar year 2019, despite the fact that USDOL reported an increased risk of fraud during this time.7 Additionally, in a May 2021 report, the USDOL Office of Inspector General found that about 60 percent of states did not report cases of fraud associated with special pandemic UI programs, as required by law.8 State Fraud Reporting State law does not explicitly require DEED to report information about fraud in the UI program to the Minnesota Legislature. Unlike federal law, state law does not specifically require DEED to report on fraud in the UI program.9 State law does, however, require DEED to produce an annual report with a description of the department’s programs, the number of clients served by those programs, an evaluation of those programs, and recommendations for changes or improvements to them.10 Although DEED provides some basic information about the UI program in its annual report, it does not include any information about UI fraud.11 7 U.S. Department of Labor, Employment and Training Administration, ETA 227: Overpayment Detection and Recovery Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy/DataDownloads.asp, accessed October 18, 2021. 8 The report did not specify whether Minnesota was among the states that did not report on fraud associated with the special pandemic UI programs. U.S. Department of Labor, Office of Inspector General, COVID-19: States Struggled to Implement CARES Act Unemployment Insurance Programs (Washington, DC, 2021), 12-14. 9 Minnesota Statutes 2021, Chapters 116J and 268. 10 Minnesota Statutes 2021, 116J.0125. 11 Minnesota Department of Employment and Economic Development, Annual Report of Department Programs and Services (St. Paul, 2020), 1-4; and Minnesota Department of Employment and Economic Development, Annual Program Summaries, https://mn.gov/deed/about/what-we-do/agency-results /program-summaries/, accessed December 6, 2021. Even though fraud has likely increased in recent years, the UI Division has reported less fraud to the federal government. Exhibit 2.1 Dollar Value of Fraud Reported to USDOL (in millions) Fraud Cases Reported to USDOL $0 $2 $4 $6 $8 $10 $12 0 2,000 4,000 6,000 8,000 2016 2017 2018 2019 2020 Calendar Year 18 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities The Minnesota Legislature could consider requiring DEED to report on a regular basis the levels of both confirmed and suspected fraud in the program. Because DEED does not report to USDOL information about the level of suspected fraud— such as overpayments made to unidentified imposters or hijackers, or unsuccessful fraud attempts made by suspected imposters or hijackers—the Legislature could consider requiring DEED to report such information. Division officials told us that imposters and hijackers have become a much larger threat to the program than they were prior to the start of the pandemic. Reporting on such cases could enable the Legislature to be better informed about the vulnerability of public funds in the UI program. Fraud Investigations The UI Division performs investigative activities for a variety of reasons. In this section, we briefly discuss the kinds of investigations that the division conducts. Investigative Activities The UI Division focuses more on preventing the loss of program dollars by imposters and hijackers than on investigating those individuals. The UI Division uses a variety of processes to detect suspicious accounts that may have been opened by imposters or hijackers, which we discuss in Chapter 3. . For example, as we discuss in Chapter 3, the division solicits reports of alleged fraud in the program from the public. . Although the UI Division has some investigative powers, those powers are limited, and the UI Division is not a law enforcement body. Under state law, the division has the authority to administer oaths, take depositions, and issue subpoenas to compel individuals to appear or produce documents necessary for the administration of the program.12 But, the division does not have the authority to investigate imposters or hijackers operating in other states or countries. If division staff are able to identify a fraudster operating in Minnesota, then they may refer that person to law enforcement (which we discuss in the next section). . Most of the investigative activities that the UI Division conducts are part of the program’s eligibility determination processes. For example, adjudicators may request information from applicants and employers to help them conclude whether an applicant misrepresented their eligibility for benefits—such as if they failed to report earnings. 12 Minnesota Statutes 2021, 268.188. Recommendation The Legislature could consider requiring DEED to report, on a regular basis, both confirmed and suspected fraud in the program. Fraud Reporting and Investigations 19 When the division determines that an applicant received an overpayment in such cases, it automatically applies a penalty.13 The division also operates several quality control programs, which regularly review samples of cases to evaluate the extent to which applicants were correctly determined as eligible or ineligible for benefits, among other things. As part of those reviews, division staff may contact applicants and employers, review applicant and employer records, and crossmatch data against external sources, among other things. Federal law requires state UI agencies to conduct such reviews as a condition of their federal administrative grants.14 Referrals The UI Division has referred few cases to law enforcement in recent years. the UI Division can make referrals to law enforcement agencies for investigation and prosecution, including to the Office of Inspector General within USDOL and to the Minnesota Bureau of Criminal Apprehension. At the federal level, the Office of Inspector General investigates fraud and abuse in the UI program. Under state law, the Minnesota Bureau of Criminal Apprehension has authority to conduct criminal investigations.15 . According to its reports to USDOL, the division referred no cases to the Office of Inspector General over the last five calendar years, and only 44 cases for state or local prosecution, as Exhibit 2.2 shows.16 13 Minnesota Statutes 2021, 268.18. 14 42 U.S. Code, sec. 503(a)(6) (2019); and 20 CFR, sec. 602.11 (2021). As we discussed in Chapter 1, these grants cover all of a state’s administrative costs to operate its UI program. We did not review these quality control programs as part of this evaluation. 15 Minnesota Statutes 2021, 299C.03. 16 U.S. Department of Labor, Employment and Training Administration, ETA 227: Overpayment Detection and Recovery Activities (Washington, DC, 2021), https://oui.doleta.gov/unemploy/DataDownloads.asp, accessed February 4, 2022. UI Fraud Cases Referred to Law Enforcement, as reported to the Federal Government Exhibit 2.2 9 5 4 14 12 2017 2018 2019 2020 2021 Calendar Year 20 Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities . .17 . We recommend that the UI Division evaluate its processes and criteria for referring cases to the Bureau of Criminal Apprehension for investigation. The UI Division should also assess whether it has dedicated sufficient resources to refer such cases and whether it has appropriately prioritized such referrals. We also recommend that the UI Division submit a formal request to the USDOL Office of Inspector General for additional assistance, coordination, and resources in investigating and combatting fraud from imposters and hijackers. 17 We reached out to representatives from the Office of Investigations within the USDOL Office of Inspector General to learn about the extent to which such cases are being investigated at the federal level, but they declined to speak with us. Recommendations • The UI Division should evaluate its processes for referring cases to the Bureau of Criminal Apprehension for investigation. • The UI Division should submit a formal request to the U.S. Department of Labor’s Office of Inspector General for additional coordination, and resources in investigating and combatting fraud from imposters and hijackers. Minnesota Department of Employment and Economic Development Office of the Commissioner First National Bank Building, 332 Minnesota Street, St. Paul MN 55101 mn.gov/deed March 11, 2022 Ms. Judy Randall, Legislative Auditor Office of the Legislative Auditor (OLA) Room 140 Centennial Building 658 Cedar Street Saint Paul, MN 55155-1603 Dear Ms. Randall, Thank you for the opportunity to comment on the Office of the Legislative Auditor’s (“OLA”) report on the Unemployment Insurance (“UI”) Division’s “Efforts to Prevent and Detect the Use of Stolen Identities.” The Minnesota Department of Employment and Economic Development (the “Department” or “DEED”), appreciates the time and effort that was put into the review of these programs. DEED values any opportunity to improve its processes and service delivery, and thanks the OLA team for its work on this report. COVID-19 Pandemic The impact of the COVID-19 Pandemic on Minnesota’s UI program – and UI programs nationally - cannot be overstated. I reemphasize this in the context of this report because it required the program to reorient all its efforts to meet an historic challenge. To counteract the unprecedented impacts of the pandemic, federal and state policymakers deployed unprecedented levels of aid and made eligibility changes to the UI programs to get benefits to workers quickly. This meant that UI program administrators had to act quickly to increase capacity tenfold while still maintaining program integrity, implementing several new programs, and rapidly moving to new business models (and new technology) that would permit staff to work remotely while still maintaining security. It was a daunting challenge with no opportunity for pre- planning. Despite these challenges, Minnesota UI responded very quickly. All staff resources were immediately re-directed to assisting applicants. Program technology met the challenge, permitting over two years’ worth of applications to be accepted in just four weeks and Minnesota UI fully implemented all new federal benefit programs more quickly than any other state. As a result of this responsiveness, the UI program was able to provide the financial support Minnesotans urgently needed. Nearly $15 billion in benefits were paid to 870,000 applicants, and eligible applicants received payments about as quickly as they did prior to the pandemic. Cybercrime The major increases in UI benefit volumes brought on by the pandemic and federal and state government’s COVID-19 Pandemic response also created an “opportunity” for cybercriminals. Since the UI program began in 1935, there have always been individuals who have attempted to obtain benefits by posing as someone else. These efforts were limited for about the first 70 years of the programs because it was simply not possible for these “imposters” to get their hands on enough identities to be more than an integrity “nuisance” for the program. Today, by contrast, the “Dark Web” Minnesota Department of Employment and Economic Development Office of the Commissioner First National Bank Building, 332 Minnesota Street, St. Paul MN 55101 mn.gov/deed enables transnational cybercriminals to buy and sell private data obtained from data breaches and culled from social media. This type of cybercrime is not uniquely a UI problem – it is a problem that the entire financial sector faces. Data breaches and cybercrime are unfortunate components of the modern interconnected financial system. As such, the UI program’s emphasis is necessarily to detect suspicious applications and stop as many of them as possible from being processed. The COVID-19 Pandemic, and the related expansion of federal unemployment benefits, amplified attempted actions by cybercriminals. As the report notes, in the month of June 2021 alone, the UI program identified – and stopped payments on - over 2,500 suspicious accounts: more than one-third of new accounts opened that month. As the report also notes, the UI program has developed a variety of approaches and business processes to detect and stop suspicious applications. OLA generally found that DEED took quick action on fraud allegation reports, and that DEED “processes were effective in quickly identifying and locking the suspicious accounts” in the data OLA analyzed. Selected Responses to OLA Report In this section, we provide responses to selected elements of the report. Reporting and Investigations As the report notes, DEED already reports fraud metrics to the USDOL as required by federal law. While, as OLA notes, the Legislature could consider requiring DEED to provide a separate report for state purposes, it may be duplicative to do so. OLA’s recommendation that “the UI Division should evaluate its processes for referring fraud cases to the Bureau of Criminal Apprehension for investigation” seems to misunderstand the nature of the crime discussed in the report. Identity fraud today is conducted transnationally by anonymous and highly distributed actors; the nature of cybercrime makes such crimes difficult for a single state’s law enforcement division to meaningfully combat. Where culprits are investigable, DEED has and will continue to refer fraud cases to the appropriate law enforcement authority. OLA additionally recommends that “the UI Division should submit a formal request to the U.S. Department of Labor’s Office of Inspector General for additional coordination and resources in investigating and combatting fraud from imposters and hijackers.” Even prior to the pandemic, Minnesota’s UI Division, and the UI divisions of other states, had met with staff at USDOL about encouraging other federal agencies with policing or regulatory authority to address the activities that take place on the dark web and the ease with which cybercriminals can use online banking and by extension UI systems to commit cybercrimes. The pandemic has highlighted the cybercriminal activities in the UI space at a federal level, and it is understood that more federal resources are being applied to address it. Fraud Prevention and Detection OLA states that “[d]uring the COVID-19 pandemic, the UI Division began temporarily locking all accounts with certain characteristics to protect against phishing attacks, which likely affected payments to some genuine applicants.” This is misleading. Phished accounts were locked, in fact, to prevent a delay in payments. Had the UI Division not intervened and reviewed the status of accounts, hijackers would have taken over the accounts and delayed payments to the genuine applicant much longer. Additionally, OLA’s statement that “[t]he UI Division relies on applicants to identify when it has incorrectly locked their accounts, which may cause burdens for those applicants” is not wholly accurate. Applicant contacts are one method, but not the only method, which the Division uses to ensure that accounts are only accessible by the appropriate individual. Page 2 of 3 March 11, 2022 Minnesota Department of Employment and Economic Development Office of the Commissioner First National Bank Building, 332 Minnesota Street, St. Paul MN 55101 mn.gov/deed The report states that “the UI Division’s new imposter screening processes delayed payments to most applicants by more than a week, even though an executive order, and subsequent legislation, temporarily suspended the typical one- week waiting period.” This misstates the purpose of the suspension of the non-payable week of benefits by Governor Walz and the legislature. Ordinarily, applicants are not eligible to receive payment for the first week of unemployment benefits they request. The purpose of Executive Order 20-05 was to “allow workers to become eligible for unemployment benefits as quickly as possible” (our emphasis).1 Individuals did become eligible for unemployment benefits as quickly as possible and received benefits for the first week of unemployment benefits as directed. DEED similarly does not agree that the imposter screening process delayed payments to “most applicants.” The screening process did, however, prevent substantial amounts of potentially fraudulent payments, as the report notes. And, as noted above, Minnesota UI fully implemented all new federal benefit programs more quickly than any other state. Regarding OLA’s recommendations that: • “The UI Division should develop processes to proactively investigate accounts that may be incorrectly identified as suspicious.” • “The UI Division should: (1) establish metrics and methods for evaluating the efficacy of its data analysis and imposter screening processes; (2) evaluate these processes on a regular basis; (3) collect the necessary data to conduct evaluations; and (4) use such evaluations to refine its processes.” • “As the initial challenges created by the COVID-19 pandemic subside, the UI Division should reevaluate some of the changes it implemented during the pandemic to prevent and detect fraud, as those changes competed with its responsibility to issue prompt payments to eligible applicants.” DEED’s responsibility is to continually work to maintain a balance between stopping cybercriminals and ensuring genuine applicants access to the benefits they are eligible for. This is not a static calculation but will vary based on both the number of cybercriminals that are active at any one time and the sophistication of the schemes they are using. Cybercrime levels will vary over time based on the level of financial opportunity. With the end of the special federal UI programs and policies, the opportunity for cybercriminals to profit from state UI systems may be reduced. In any event, DEED is committed to continually monitoring and updating its approach to detecting and stopping cybercriminals. Conclusion In closing, DEED appreciates OLA’s efforts in drafting this report, and is committed to continuing to deliver high quality services for the people of Minnesota. As noted throughout the report, DEED took, and continues to take, significant and highly effective measures to ensure that Minnesota’s UI application has a robust and resilient response to active and emergent cyberthreats. Sincerely, Steve Grove Commissioner 1 https://mn.gov/governor/assets/2020_03_16_EO_20-05_Unemployment_Insurance_tcm1055-423379.pdf Page 3 of 3 March 11, 2022 Recent OLA Evaluations Agriculture Pesticide Regulation, 2020 Agricultural Utilization Research Institute (AURI), May 2016 Agricultural Commodity Councils, 2014 Criminal Justice and Public Safety Driver Examination Stations, 2021 Safety in State Correctional Facilities, February 2020 Guardian ad Litem Program, 2018 Mental Health Services in County Jails, 2016 Health Services in State Correctional Facilities, 2014 Law Enforcement’s Use of State Databases, 2013 Economic Development Minnesota Investment Fund, February 2018 Minnesota Research Tax Credit, February 2017 Iron Range Resources and Rehabilitation Board (IRRRB), March 2016 Education (Preschool, K-12, and Postsecondary) Minnesota Department of Education’s Role in Addressing the Achievement Gap, March 2022 Collaborative Urban and Greater Minnesota Educators of Color (CUGMEC) Grant Program, 2021 Compensatory Education Revenue, 2020 Debt Service Equalization for School Facilities, March 2019 Early Childhood Programs, 2018 Perpich Center for Arts Education, January 2017 Standardized Student Testing, 2017 Minnesota State High School League, 2017 Minnesota Teacher Licensure, March 2016 Special Education, March 2013 Environment and Natural Resources Petroleum Remediation Program, February 2022 Public Facilities Authority: Wastewater Infrastructure Programs, January 2019 Clean Water Fund Outcomes, 2017 Department of Natural Resources: Deer Population Management, 2016 Recycling and Waste Reduction, February 2015 DNR Forest Management, August 2014 Conservation Easements, February 2013 Sustainable Forest Incentive Program, November 2013 Financial Institutions, Insurance, and Regulated Industries Department of Commerce’s Civil Insurance Complaint Investigations, February 2022 Government Operations Office of Minnesota Information Technology Services (MNIT), February 2019 Mineral Taxation, 2015 Councils on Asian-Pacific Minnesotans, Black Minnesotans, Chicano/Latino People, and Indian Affairs, 2014 Health Emergency Ambulance Services, 2022 Office of Health Facility Complaints, 2018 Minnesota Department of Health Oversight of HMO Complaint Resolution, February 2016 Minnesota Health Insurance Exchange (MNsure), February 2015 Minnesota Board of Nursing: Complaint Resolution Process, 2015 Human Services DHS Oversight of Personal Care Assistance, 2020 Home- and Community-Based Services: Financial Oversight, February 2017 Managed Care Organizations’ Administrative Expenses, 2015 State-Operated Human Services, February 2013 Medical Assistance Payment Rates for Dental Services, 2013 Jobs, Training, and Labor Unemployment Insurance Program: Efforts to Prevent and Detect the Use of Stolen Identities, March 2022 State Protections for Meatpacking Workers, 2015 State Employee Union Fair Share Fee Calculations, July 2013 Miscellaneous Board of Cosmetology Licensing, 2021 Minnesota Department of Human Rights: Complaint Resolution Process, February 2020 Public Utilities Commission’s Public Participation Processes, July 2020 Economic Development and Housing Challenge Program, February 2019 Minnesota State Arts Board Grant Administration, February 2019 Board of Animal Health’s Oversight of Deer and Elk Farms, 2018 Voter Registration, 2018 Minnesota Film and TV Board, 2015 Transportation MnDOT Workforce and Contracting Goals, 2021 MnDOT Measures of Financial Effectiveness, March 2019 MnDOT Highway Project Selection, 2016 MnDOT Selection of Pavement Surface for Road Rehabilitation, 2014 MnDOT Noise Barriers, 2013 OLA reports are available at www.auditor.leg.state.mn.us or by calling 651-296-4708. OFFICE OF THE LEGISLATIVE AUDITOR CENTENNIAL OFFICE BUILDING – SUITE 140 658 CEDAR STREET – SAINT PAUL, MN 55155
File and source
- File
- REPORT_MN-Legislative-Auditor_UI-stolen-identities-fraud_2022-03.pdf
- Size
- 2,894,095 bytes
- SHA-256
- b9de2955817c336ae81ddf75409a76df4cc81a5209740368e7529e78b945e630
- Original
- www.auditor.leg.state.mn.us